Will Miao 8348a0cef8 fix(download): harden HF download path validation, fix WebSocket leak, add URL detection tests (#965, #977) ...

Security hardening:
- Validate repo format with strict regex (reject .. traversal)
- Validate filename rejects path separators and ..
- Validate relative_path rejects absolute paths and ..
- Verify model_root is within configured scanner roots using
  realpath + os.sep guard to prevent prefix-match bypass
- Add realpath-based escape detection for final dest_path

Bug fixes:
- Fix WebSocket leak in _downloadHfSingle: wrap ws.close() in
  try/finally so it closes even if downloadHfModel() throws
- Same fix for batch HF download per-file WebSocket loop

Frontend hardening:
- Tighten HF repo regex: require huggingface.co for full URLs,
  reject bare .. patterns
- Add 12 unit tests for detectUrlType() covering HF resolve,
  HF repo, CivitAI, CivArchive, direct HTTP, edge cases

2026-07-01 05:51:58 +08:00

..

import

fix(import): discover LoRA + checkpoint from modelVersionIds when API meta is null

2026-06-27 17:05:38 +08:00

BannerService.js

feat(cache): add cache health monitoring and validation system, see #730

2026-02-02 08:30:59 +08:00

BatchImportManager.js

fix(recipe): prevent empty grid by removing preserveScroll from refresh triggers

2026-06-02 08:15:29 +08:00

BulkManager.js

fix(marquee): use document coordinates, add auto-scroll, support VirtualScroller off-screen cards

2026-06-27 08:21:21 +08:00

BulkMissingLoraDownloadManager.js

fix(recipe): prevent empty grid by removing preserveScroll from refresh triggers

2026-06-02 08:15:29 +08:00

DoctorManager.js

feat(settings): hide API key from frontend, use status+edit instead of password field

2026-06-19 08:05:04 +08:00

DownloadManager.js

fix(download): harden HF download path validation, fix WebSocket leak, add URL detection tests (#965, #977)

2026-07-01 05:51:58 +08:00

ExampleImagesManager.js

feat(example-images): add check pending models endpoint and improve async handling

2026-02-02 12:31:07 +08:00

FilterManager.js

fix(recipe): prevent empty grid by removing preserveScroll from refresh triggers

2026-06-02 08:15:29 +08:00

FilterPresetManager.js

fix(filters): apply preset base models from full list

2026-04-18 07:00:24 +08:00

HelpManager.js

feat(ui): enhance settings modal styling and add priority tags tabs

2025-10-11 19:43:22 +08:00

ImportManager.js

feat(import): add import-only option for recipes without downloading missing LoRAs

2026-03-25 11:56:34 +08:00

LoadingManager.js

fix: actually halt bulk operations on cancel — frontend AbortController + backend guards (#986)

2026-06-17 07:20:32 +08:00

ModalManager.js

feat(doctor): improve duplicate filename conflict UX with confirm modal, syntax-format nav, and i18n

2026-05-25 21:25:35 +08:00

MoveManager.js

fix(virtual-scroll): avoid full reload on move-to-folder, scroll to top on filter/page reset

2026-06-19 09:18:49 +08:00

OnboardingManager.js

fix: persist onboarding and banner dismiss state to backend

2026-01-29 08:48:04 +08:00

SearchManager.js

feat(ui): add keyboard shortcut cue in search bar, fix clear button positioning

2026-06-24 20:21:15 +08:00

SettingsManager.js

refactor(settings): rename update_flag_strategy to version_grouping with migration

2026-06-22 16:59:32 +08:00

UpdateService.js

fix(ui): escape HTML entities in parseMarkdown to prevent swallowed angle brackets

2026-05-27 06:40:13 +08:00